WordPress Plugin Vulnerabilities

SAML Single Sign On (Multiple Versions) - Unauthenticated Privilege Escalation

Description

The plugins are vulnerable to Privilege Escalation, making it possible for unauthenticated attackers to elevate their privileges to that of an administrator.

Affects Plugins

Plugin icon
miniorange-saml-20-single-sign-on
Fixed in 5.4.5
Plugin icon
miniorange-saml-20-single-sign-on
Fixed in 13.0.4
Plugin icon
miniorange-saml-20-single-sign-on
Fixed in 17.0.6
Plugin icon
miniorange-saml-20-single-sign-on
Fixed in 20.2.8
Plugin icon
miniorange-saml-20-single-sign-on
Fixed in 26.0.3
Plugin icon
miniorange-saml-20-single-sign-on
Fixed in 32.0.8
Plugin icon
miniorange-saml-20-single-sign-on
Fixed in 35.0.7

References

CVE
CVE-2026-61979
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/cb03eb79-27c9-4a9d-b690-71946e11f39f

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
sequence_X0
Verified
Yes
WPVDB ID
10bb5bc2-0f32-40c1-8ab3-42b20b86a6b9

Timeline

Publicly Published
2026-08-13 (about 2 months ago)
Added
2026-08-20 (about 1 month ago)
Last Updated
2026-10-16 (about 9 hours ago)

Other

Published
Title
Published
2024-12-18
Title
AI Magic < 1.0.6 - Unauthenticated Privilege Escalation
Published
2024-10-25
Title
Exam Matrix <= 1.5 - Unauthenticated Privilege Escalation
Published
2026-10-15
Title
My Calendar < 3.8.8 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute
Published
2026-05-19
Title
Easy Elements for Elementor < 1.4.5 - Unauthenticated Privilege Escalation via easyel_handle_register
Published
2016-06-06
Title
Newspaper Theme 6.4–6.7.1 - Privilege Escalation